# migrationctowojak.xyz — SUSPICIOUS

> Beware of phishing attempts from migrationctowojak.xyz. Avoid clicking links and protect your data from this active medium-risk domain.

## Summary
PhishDestroy identifies migrationctowojak.xyz as a generic phishing domain registered on March 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. This classification is based on its suspicious activity and domain characteristics.

The domain resolves to IP 104.21.18.60 and is flagged by 4 out of 95 security vendors on VirusTotal, indicating a notable risk. The hosting infrastructure suggests a potential phishing campaign designed to deceive users and harvest credentials.

Currently, migrationctowojak.xyz remains active with a medium risk level. Users are advised to avoid interacting with this domain, and security teams should monitor and block it to prevent potential compromise.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: $WOJAK Migration Portal

## Domain Intelligence
- Registered: 2026-03-06 15:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 104.21.18.60
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: alberto.ns.cloudflare.com teagan.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["alphaMountain.ai", "Ermes", "Forcepoint ThreatSeeker", "Fortinet"]
- Google Safe Browsing: clean
- Blocklists: 4 hits
  Lists: ["PhishDestroy", "MetaMask", "ScamSniffer", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc365-5c36-77bd-8826-b00ab99dbdf5.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/migrationctowojak.xyz
- PhishDestroy: https://phishdestroy.io/domain/migrationctowojak.xyz/
- LLM endpoint: https://phishdestroy.io/domain/migrationctowojak.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/migrationctowojak.xyz/
Last updated: 2026-03-19